Threatdown (Malwarebytes)Install

Summary

Sends a POST request to the Threatdown (Malwarebytes) detections search group-by endpoint to get detections aggregated by a chosen field, with cursor-based pagination.

Inputs

• Body Fields > Group By — Field to group detections by (request body group_by). Defaults to account_id.
• Body Fields > Next Cursor — Pagination cursor (next_cursor) from a previous response, used to fetch the next page. Empty by default.
• Body Fields > Page Size — Number of results per page (page_size). Defaults to 2000.
• Additional JSON Body — Extra request body values as JSON. These are merged with the Body Fields, so you can add filters or other API-supported properties.

Output shape

The API's JSON response for the grouped detections search, normalized into n8n items. The source shows a normalizeResponse helper, but its exact item splitting isn't visible.

Results are paginated. Pass the returned next cursor into Next Cursor to get further pages. The source pack shows only function signatures, so details of error handling and of how Additional JSON Body overrides Body Fields (a merge helper exists) aren't confirmed.

Examples

Example 1: Count detections per account

Leave Group By as account_id, with the default Page Size of 2000.

Example 2: Fetch the next page of results

Set Next Cursor to the cursor value returned by the previous run, and keep Group By and Page Size the same.

Example 3: Add custom filters to the search

Put the extra API body properties in Additional JSON Body, for example {"filter": {...}}, and set Group By as needed.

Links

• n8n community nodes installation guide